ClawHub
Back to skill

Security audit

Inventory Planning Ledger

Security checks for vulnerabilities and agentic risk

Overview

This is a narrow markdown-only skill for turning a supplied inventory quantity into a structured recorded_quantity response.

This skill is reasonable to install for simple inventory-planning quantity formatting. Users should provide an explicit integer quantity and understand that the artifact only returns a structured response; it does not actually update an inventory system or ledger by itself.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger language is broad enough that the skill could activate on generic requests about recording or planning inventory quantities without strong scoping. That can cause unintended invocation, confusing behavior, or accidental processing in contexts where the user did not clearly intend to use this skill, though the skill itself appears low-privilege and data-transformative.

Static analysis

No suspicious patterns detected.